Fork: 0
OpenStack / openstack-caracal-dc-dc
Transfer to URL with SHA Find file
Newer
Older
openstack-caracal-dc-dc / docs / changelog-20260718-permission-posture-ask-preempts-classifier.md
@JANeumatrix JANeumatrix 1 day ago 2 KB Permission posture: ask-list mutation surfaces so they PROMPT (not classifier-deny)
Raw Blame History

Changelog 2026-07-18 -- permission posture: mutations PROMPT, not classifier-deny

Problem

The session runs in Claude Code auto permission mode. Mutations that matched NO permissions rule (e.g. bash scripts/opnsense-api.sh POST ..., editing .claude/settings*.json, invoking a Skill) fell through to the auto-mode classifier, which hard-denied them -- no approval prompt, so the operator could not approve/adjust and had to run them by hand. That is a wall, not a gate.

Finding (claude-code-guide, doc-cited)

deny and explicit ask rules are evaluated before the auto-mode classifier (Claude Code auto-mode-config docs). An explicit ask rule therefore FORCES a prompt even in auto mode. So the fix is to ask-list the mutation surfaces; they become approve/deny/adjust prompts instead of classifier hard-denials.

Change (.claude/settings.json, operator-applied)

Added to ask (mutations now PROMPT): Bash(*opnsense-api.sh POST *), Bash(*opnsense-plugins.sh apply*), Bash(*tofu apply*), Bash(*tofu destroy*), Bash(*tofu import*), Bash(*tofu state rm*), Bash(*--commit*), Edit(.claude/settings.json), Edit(.claude/settings.local.json). Added to allow (read-only edge queries stay frictionless): Bash(OPNSENSE_API_HOST=* bash scripts/opnsense-api.sh GET *), Bash(bash scripts/opnsense-plugins.sh list*). deny + the PreToolUse guard hook UNCHANGED. Broad *-patterns catch the verb (POST/apply/--commit/tofu-mutations) to reduce future whack-a-mole.

The Edit(.claude/settings*.json) ask rules bootstrap self-service: from now on the agent CAN propose settings edits -- they arrive as prompts the operator approves, instead of being hard-denied (the chicken-and-egg that required this first edit to be operator-applied by hand).

Rationale for staying in auto + ask (not flipping to default mode)

default mode would prompt on ALL non-allow-listed commands including read-only probes (ssh, journalctl, ping, pkg info) -- very noisy for this read-heavy audit work. auto + comprehensive ask keeps reads frictionless and makes mutations prompt: the exact requested behavior.

Revert

git revert this commit (restores the prior .claude/settings.json), or cp .claude/settings.json.bak .claude/settings.json (operator's local backup).